Remus Stealer - 64-bit evolution of LummaC2

Remus Stealer is a rapidly evolving Malware-as-a-Service infostealer that emerged in 2026.

Remus also shifted from Lumma's 32-bit architecture and traditional resolvers to 64-bit with EtherHiding and enhanced anti-analysis (e.g., sandbox DLL checks, PST honeypot detection).

• It utilizes EtherHiding, storing C2 addresses in Ethereum smart contracts to avoid takedowns.
• The malware steals credentials, browser cookies, authentication tokens, and cryptocurrency wallet data.
• Session theft is one of Remus's most dangerous capabilities because it can bypass MFA by stealing active session cookies directly from browser memory.
• The malware shows strong technical similarities to Lumma Stealer and may represent its evolutionary successor.
• Financial services, healthcare, government, technology firms, and MSPs are particularly attractive targets.
• Common infection vectors include phishing, fake software downloads, malvertising, and fake CAPTCHA campaigns, as well as SEO poisoning and fake GitHub projects to trick tech-savvy users.

See whole

Check out whole malware analysis report at